1NDISASM(1) General Commands Manual NDISASM(1)
2
6 ndisasm - the Netwide Disassembler, an 80x86 binary file disassembler
7
9 ndisasm [ -o origin ] [ -s sync-point [...]] [ -a | -i ] [ -b bits ] [
10 -u ] [ -e hdrlen ] [ -k offset,length [...]] infile
11 ndisasm -h
12 ndisasm -r
13
15 The ndisasm command generates a disassembly listing of the binary file
16 infile and directs it to stdout.
17 OPTIONS
19 -h Causes ndisasm to exit immediately, after giving a summary of
20 its invocation options.
21 -r Causes ndisasm to exit immediately, after displaying its version
23 number.
24 -o origin
26 Specifies the notional load address for the file. This option
27 causes ndisasm to get the addresses it lists down the left hand
28 margin, and the target addresses of PC-relative jumps and calls,
29 right.
30 -s sync-point
32 Manually specifies a synchronisation address, such that ndisasm
33 will not output any machine instruction which encompasses bytes
34 on both sides of the address. Hence the instruction which starts
35 at that address will be correctly disassembled.
36 -e hdrlen
38 Specifies a number of bytes to discard from the beginning of the
39 file before starting disassembly. This does not count towards
40 the calculation of the disassembly offset: the first disassem‐
41 bled instruction will be shown starting at the given load
42 address.
43 -k offset,length
45 Specifies that length bytes, starting from disassembly offset
46 offset, should be skipped over without generating any output.
47 The skipped bytes still count towards the calculation of the
48 disassembly offset.
49 -a or -i
51 Enables automatic (or intelligent) sync mode, in which ndisasm
52 will attempt to guess where synchronisation should be performed,
53 by means of examining the target addresses of the relative jumps
54 and calls it disassembles.
55 -b bits
57 Specifies 16-, 32- or 64-bit mode. The default is 16-bit mode.
58 -u Specifies 32-bit mode, more compactly than using `-b 32'.
60 -p vendor
62 Prefers instructions as defined by vendor in case of a conflict.
63 Known vendor names include intel, amd, cyrix, and idt. The
64 default is intel.
65
67 ndisasm only disassembles binary files: it has no understanding of the
68 header information present in object or executable files. If you want
69 to disassemble an object file, you should probably be using objdump(1).
70 Auto-sync mode won't necessarily cure all your synchronisation prob‐
72 lems: a sync marker can only be placed automatically if a jump or call
73 instruction is found to refer to it before ndisasm actually disassem‐
74 bles that part of the code. Also, if spurious jumps or calls result
75 from disassembling non-machine-code data, sync markers may get placed
76 in strange places. Feel free to turn auto-sync off and go back to doing
77 it manually if necessary.
78
80 objdump(1).
81 The Netwide Assembler Project NDISASM(1)